nomen-lang 0.7.0 → 0.7.1

package/dist/index.mjs

@@ -9989,10 +9989,13 @@ function is_compiler_temp_name$2(name) {
 * the generic call builder), since monomorphized tuple inits route through
 * each of them.
 */
-function mark_tuple_literal_move_owners(node, status) {
+function mark_tuple_literal_move_owners(node, status, on_move) {
 	if (!node.type?.name?.startsWith("_Tuple_")) return;
 	if (!status.moved) status.moved = /* @__PURE__ */ new Set();
-	for (const p of node.params) if (p.node_type === "value" && p.is_moved && typeof p.value === "string") status.moved.add(p.value);
+	for (const p of node.params) if (p.node_type === "value" && p.is_moved && typeof p.value === "string") {
+		status.moved.add(p.value);
+		on_move?.(p.value);
+	}
 }
 //#endregion
 //#region ../src/build_common/string_escapes.ts
@@ -16045,6 +16048,28 @@ function emit_var_store(status, reg, name, size) {
 		}
 	}
 }
+/**
+* Save the fat (x0, x1) return pair at [x29, #offset]. The stp/ldp simm7
+* scaled range tops out at +504 — split into the 12-bit-scaled str/ldr
+* halves beyond it.
+*/
+function emit_return_pair_save(status, offset) {
+	if (offset + 8 > 504) {
+		emit_asm(status, `str x0, [x29, #${offset}]\n`);
+		emit_asm(status, `str x1, [x29, #${offset + 8}]\n`);
+		return;
+	}
+	emit_asm(status, `stp x0, x1, [x29, #${offset}]\n`);
+}
+/** Restore the fat (x0, x1) return pair from [x29, #offset]. */
+function emit_return_pair_restore(status, offset) {
+	if (offset + 8 > 504) {
+		emit_asm(status, `ldr x0, [x29, #${offset}]\n`);
+		emit_asm(status, `ldr x1, [x29, #${offset + 8}]\n`);
+		return;
+	}
+	emit_asm(status, `ldp x0, x1, [x29, #${offset}]\n`);
+}
 //#endregion
 //#region ../src/build_aarch64/slp_pair.ts
 /**
@@ -16725,6 +16750,61 @@ function try_emit_slp_pair(index, ctx_ast, ctx_stmts, status) {
 	return 2;
 }
 //#endregion
+//#region ../src/build_common/box_clone.ts
+/**
+* The load/transfer deep-copy story for `Box<T>` FIELDS on mv struct elements
+* of mv containers (2026-10-12, the Valen-comparison repro): a
+* `List<Ship>` whose `Ship` holds `var Box<Engine> engine` used to come back
+* from `load_T` with the element's box SHALLOW — the copy's scope-exit
+* destroy freed the slot's shared wrapper (SIGTRAP on the next use). `Box<T>`
+* joins the deep-copy/transfer set: `load_T` clones the wrapper
+* (`<Box_T>_box_clone` — malloc + byte copy + fresh copies of the pointee's
+* owned fields), and `store_T`/`replace_T` transfer it (the donor's field is
+* zeroed — the slot is the sole owner). The clone helper is emitted lazily
+* per backend (this module carries only the shared predicates).
+*/
+/** The clone helper's symbol for a Box mono (`Box_Engine` → `Box_Engine_box_clone`). */
+function box_clone_fn_name(box_mono_name) {
+	return `${box_mono_name}_box_clone`;
+}
+/**
+* The monomorphized `Box<T>` wrapper when `type` is a box field type, else
+* undefined. Shape-checked through `is_box_type` (single `__value` field,
+* compiler-stamped storage class), so a USER struct named `Box_*` is not
+* mistaken for the wrapper.
+*/
+function box_field_mono(type, table) {
+	if (!type.name || type.is_ref || type.is_view || type.is_array) return void 0;
+	const mono = resolve_struct_type(type, table);
+	if (!mono || !mono.is_class) return void 0;
+	return is_box_type(mono.name, table.structs) ? mono : void 0;
+}
+/** The `__value` field's type (the pointee). The wrapper is shape-checked to
+*  have exactly one field. */
+function box_pointee_type(box_mono) {
+	return box_mono.fields[0]?.type;
+}
+/** Whether `<E>_copy` yields a fully independent value: no case payload is a
+*  class/trait reference (those are shared pointers the copy cannot
+*  duplicate — a cloned blob sharing one would free it twice at teardown). */
+function enum_copy_is_deep$1(elem, table) {
+	for (const c of elem.cases) for (const p of c.params) if (table.structs.find((s) => s.name === p.type.name)?.is_class || table.traits?.some((t) => t.name === p.type.name)) return false;
+	return true;
+}
+/**
+* Whether the pointee's plain `string` fields are heap-owned by the wrapper —
+* the same gate the box CONSTRUCTOR uses when normalizing the incoming value
+* (build_declaration_node's boxing path): an OWNING pointee's strings are
+* uniformly heap (transferred as-is), and a pointee without a user `#destroy`
+* that needs the auto destroy had its rodata/borrow fields strdup'd at
+* boxing. Anything else (a non-owning pointee with a user `#destroy`) may
+* still hold borrowed bytes the wrapper destroy never frees — the clone must
+* NOT strdup those (it would leak per clone).
+*/
+function box_pointee_strings_are_heap(pointee, table) {
+	return owns_strings_uniformly(pointee) || !has_destroy(pointee) && struct_needs_auto_destroy(pointee, table);
+}
+//#endregion
 //#region ../src/build_common/temp_anchor_consolidation.ts
 /**
 * Shared OWNERSHIP decision for hoisted call-temporary consolidation.
@@ -16804,6 +16884,20 @@ function emit_borrow_carrier_owned_free(status, elem, decl_name) {
 	for (const field of elem.fields) {
 		const size = get_type_size(field.type, status);
 		if (!field.type.is_ref && !field.type.is_view && !field.type.is_array && !field.type.is_nullable && field.type.name !== "string") {
+			const box_mono = box_field_mono(field.type, status);
+			if (box_mono) {
+				emit_var_address(status, "x0", decl_name);
+				emit_asm(status, `ldr x0, [x0, #${offset}]\n`);
+				const skip = `.Lskip_bcc_${status.label_counter = (status.label_counter ?? 0) + 1}`;
+				emit_asm(status, `cbz x0, ${skip}\n`);
+				emit_asm(status, `str x0, [sp, #-16]!\n`);
+				emit_asm(status, `bl ${box_mono.name}_destroy\n`);
+				emit_asm(status, `ldr x0, [sp], #16\n`);
+				emit_free(status);
+				emit_asm(status, `${skip}:\n`);
+				offset += size;
+				continue;
+			}
 			const field_struct = resolve_struct_type(field.type, status);
 			if (field_struct && !field_struct.is_class && is_load_deep_copy_container(field_struct.name) && struct_needs_destroy(field_struct, status) && field_struct.functions.find((f) => f.name === "copy")) {
 				emit_var_address(status, "x0", decl_name);
@@ -16906,6 +17000,38 @@ function exit_scope_frame(status, old) {
 	if (saved_offsets) status.stack_offsets = saved_offsets;
 	status.register_allocations = status.register_allocations_frames?.pop();
 }
+/**
+* Reclaim a freshly-built OWNED call result sitting in the result registers —
+* the `while` POST-STATEMENT (update) position, where the value is created and
+* discarded in the same expression and nothing else can have moved it:
+*
+* - `string` (non-view): the fat pair's ptr half is in x0 — free it.
+* - class instance: the heap pointer is in x0 — `<T>_destroy`, then free
+*   (the pointer parks on the stack across the destroy call).
+* - owning value struct: the call landed the blob in its `_call_ret_N` sret
+*   temp with the slot ADDRESS in x0 — `<T>_destroy` walks it in place; the
+*   stack temp itself needs no free.
+*
+* Mirrors the C backend's statement-expression capture in
+* build_while_loop_node and the checker's bare-statement `_disc_N` hoist
+* (which cannot run in the update position — the update must re-evaluate per
+* iteration). Clears last_result_is_heap: the value was consumed here.
+*/
+function emit_discarded_owned_result_free(status, type) {
+	const resolved_name = resolve_struct_name(type.name, type.type_args, status);
+	const struct_type = is_struct_type$4(resolved_name, status) || is_struct_type$4(type.name, status);
+	if (type.name === "string") emit_free(status);
+	else if (struct_type?.is_class) {
+		const skip = `.Lskip_upd_${status.label_counter = (status.label_counter ?? 0) + 1}`;
+		emit_asm(status, `cbz x0, ${skip}\n`);
+		emit_asm(status, `str x0, [sp, #-16]!\n`);
+		emit_asm(status, `bl ${resolved_name}_destroy\n`);
+		emit_asm(status, `ldr x0, [sp], #16\n`);
+		emit_free(status);
+		emit_asm(status, `${skip}:\n`);
+	} else if (struct_type) emit_asm(status, `bl ${resolved_name}_destroy\n`);
+	status.last_result_is_heap = false;
+}
 /** Every declaration frame a `return` must clean: enclosing scopes first,
 *  the current (innermost) frame last — matching fall-through cleanup order. */
 function all_scope_frames(status) {
@@ -16940,6 +17066,12 @@ function mark_heap_string(status, name) {
 	if (!status.heap_strings) status.heap_strings = /* @__PURE__ */ new Set();
 	status.heap_strings.add(name);
 	if (status.heap_cleanup_stack?.length) status.heap_cleanup_stack[status.heap_cleanup_stack.length - 1].heap_strings.add(name);
+	if (status.function_return_label && !status.mv_owns_flag?.has(name)) {
+		const flag_offset = allocate_stack_space(status, 8, 8);
+		emit_asm(status, `str xzr, [x29, #${flag_offset}]\n`);
+		if (!status.mv_owns_flag) status.mv_owns_flag = /* @__PURE__ */ new Map();
+		status.mv_owns_flag.set(name, flag_offset);
+	}
 }
 function anchor_heap_pointer(status, var_name, frame_index, is_nullable) {
 	const offset = allocate_stack_space(status, 8, 8);
@@ -17254,6 +17386,135 @@ function release_records_for_scope_exit(status, decl, moved) {
 	}
 	release_heap_string_fields(status, decl.name, decl.type.name, decl.type.is_nullable);
 }
+/**
+* Scope-exit / return cleanup for a declaration that the build-time `moved`
+* set says was moved out. For an owning `mv` value-struct local the move may
+* be CONDITIONAL (inside a branch/loop): the local still owns its value on the
+* path that skips the move, so the destroy is guarded on the local's runtime
+* "moved" flag (0 = owns, 1 = moved out). On the not-moved path the struct's
+* string fields (the `#init`-strdup'd default included) are freed; on the
+* moved path the callee already reclaimed them and the guard skips. Without a
+* flag (params, temporaries, non-owning structs) the records are released as
+* before.
+*/
+function emit_moved_local_cleanup(status, decl) {
+	const owns_flag = status.mv_owns_flag?.get(decl.name);
+	if (owns_flag !== void 0 && decl.type.name === "string" && !decl.type.is_array && status.heap_strings?.has(decl.name)) {
+		const skip = `.Lskip_mvowns_${status.label_counter = (status.label_counter ?? 0) + 1}`;
+		emit_asm(status, `ldr x9, [x29, #${owns_flag}]\n`);
+		emit_asm(status, `cbnz x9, ${skip}\n`);
+		emit_var_load(status, "x0", decl.name, 8);
+		emit_free(status);
+		emit_asm(status, `${skip}:\n`);
+		return;
+	}
+	const resolved = resolve_decl_struct(decl, status);
+	if (owns_flag !== void 0 && resolved?.struct_type.is_owning === true && !resolved.struct_type.name.startsWith("_Tuple_") && !resolved.struct_type.name.startsWith("_Anon_")) {
+		const skip = `.Lskip_mvowns_${status.label_counter = (status.label_counter ?? 0) + 1}`;
+		emit_asm(status, `ldr x9, [x29, #${owns_flag}]\n`);
+		emit_asm(status, `cbnz x9, ${skip}\n`);
+		const had = !!status.moved?.has(decl.name);
+		status.moved?.delete(decl.name);
+		emit_destroy_for_decl(status, decl.name, resolved.type_name, void 0, resolved.type_args, decl.type.is_nullable);
+		if (had) status.moved?.add(decl.name);
+		emit_asm(status, `${skip}:\n`);
+		return;
+	}
+	release_heap_string_fields(status, decl.name, decl.type.name, decl.type.is_nullable);
+}
+/**
+* Emit the reclaim for a heap-registered ARRAY declaration: an owned
+* fat-string array (`heap_string_arrays` — heap or inline storage), a
+* class-element array (`heap_class_arrays`), or a heap `Array<T>` buffer
+* (`heap_array_vars`, with `heap_owned_string_arrays` marking owned
+* fat-string elements freed slot-by-slot before the buffer). Returns true
+* when the name was registered and the reclaim was emitted.
+*
+* This is the RETURN-path variant of emit_destroy_for_scope's arms: a
+* `return` runs its own declaration cleanup and then jumps straight to the
+* function's return label, so the scope-exit walk's copy of the reclaim
+* never executes on that path — a hoisted `Array<T>` literal temp (or a
+* call-result buffer) leaked on every return that exits its scope. The
+* labels are counter-suffixed: the fall-through scope-exit walk (unreachable
+* after a `return`, but still emitted) may carry the same decl's reclaim,
+* and duplicating `.Lhosa_${name}` broke the assembler.
+*/
+function emit_heap_array_decl_destroy(status, decl_name) {
+	const label_id = status.label_counter = (status.label_counter ?? 0) + 1;
+	if (status.heap_string_arrays?.has(decl_name)) {
+		const registered = status.heap_string_arrays.get(decl_name);
+		const len = Math.abs(registered);
+		if (registered > 0) {
+			for (let j = 0; j < len; j++) {
+				emit_var_load(status, "x0", decl_name, 8);
+				emit_asm(status, `ldr x0, [x0, #${8 + j * 16}]\n`);
+				const skip = `.Lskip_hsa_${decl_name}_${label_id}_${j}`;
+				emit_asm(status, `cbz x0, ${skip}\n`);
+				emit_free(status);
+				emit_asm(status, `${skip}:\n`);
+			}
+			emit_var_load(status, "x0", decl_name, 8);
+			emit_free(status);
+		} else for (let j = 0; j < len; j++) {
+			emit_var_address(status, "x0", decl_name);
+			emit_asm(status, `ldr x0, [x0, #${j * 16}]\n`);
+			const skip = `.Lskip_hsa_${decl_name}_${label_id}_${j}`;
+			emit_asm(status, `cbz x0, ${skip}\n`);
+			emit_free(status);
+			emit_asm(status, `${skip}:\n`);
+		}
+		return true;
+	}
+	if (status.heap_class_arrays?.has(decl_name)) {
+		emit_asm(status, `str x19, [sp, #-16]!\n`);
+		emit_asm(status, `str x20, [sp, #-16]!\n`);
+		emit_var_load(status, "x0", decl_name, 8);
+		emit_asm(status, `mov x19, x0\n`);
+		emit_asm(status, `ldr x20, [x19]\n`);
+		emit_asm(status, `add x19, x19, #8\n`);
+		const skip = `.Lskip_cls_${decl_name}_${label_id}`;
+		const label = `.Lcls_${decl_name}_${label_id}`;
+		emit_asm(status, `${label}:\n`);
+		emit_asm(status, `cbz x20, ${skip}\n`);
+		emit_asm(status, `ldr x0, [x19]\n`);
+		emit_free(status);
+		emit_asm(status, `add x19, x19, #8\n`);
+		emit_asm(status, `sub x20, x20, #1\n`);
+		emit_asm(status, `cbnz x20, ${label}\n`);
+		emit_asm(status, `${skip}:\n`);
+		emit_var_load(status, "x0", decl_name, 8);
+		emit_free(status);
+		emit_asm(status, `ldr x20, [sp], #16\n`);
+		emit_asm(status, `ldr x19, [sp], #16\n`);
+		return true;
+	}
+	if (status.heap_array_vars?.has(decl_name)) {
+		emit_asm(status, `str x19, [sp, #-16]!\n`);
+		emit_asm(status, `str x20, [sp, #-16]!\n`);
+		if (status.heap_owned_string_arrays?.has(decl_name)) {
+			emit_var_load(status, "x0", decl_name, 8);
+			emit_asm(status, `mov x19, x0\n`);
+			emit_asm(status, `ldr x20, [x19]\n`);
+			emit_asm(status, `add x19, x19, #8\n`);
+			const loop = `.Lhosa_${decl_name}_${label_id}`;
+			const done = `.Lhosa_done_${decl_name}_${label_id}`;
+			emit_asm(status, `${loop}:\n`);
+			emit_asm(status, `cbz x20, ${done}\n`);
+			emit_asm(status, `ldr x0, [x19]\n`);
+			emit_free(status);
+			emit_asm(status, `add x19, x19, #16\n`);
+			emit_asm(status, `sub x20, x20, #1\n`);
+			emit_asm(status, `b ${loop}\n`);
+			emit_asm(status, `${done}:\n`);
+		}
+		emit_var_load(status, "x0", decl_name, 8);
+		emit_free(status);
+		emit_asm(status, `ldr x20, [sp], #16\n`);
+		emit_asm(status, `ldr x19, [sp], #16\n`);
+		return true;
+	}
+	return false;
+}
 function emit_destroy_for_decl(status, decl_name, decl_type_name, addr_offset, type_args, is_nullable) {
 	const moved = status.moved ?? /* @__PURE__ */ new Set();
 	release_records_for_scope_exit(status, {
@@ -17265,6 +17526,7 @@ function emit_destroy_for_decl(status, decl_name, decl_type_name, addr_offset, t
 		}
 	}, moved);
 	if (moved.has(decl_name)) return;
+	if (addr_offset === void 0 && emit_heap_array_decl_destroy(status, decl_name)) return;
 	if (decl_type_name === "func" && status.stack_offsets?.has(decl_name)) {
 		const skip = `.Lclosure_free_done_${status.label_counter = (status.label_counter ?? 0) + 1}`;
 		const no_destroy = `.Lclosure_no_destroy_${status.label_counter = (status.label_counter ?? 0) + 1}`;
@@ -17568,7 +17830,10 @@ function emit_destroy_for_scope(status, declarations_before) {
 		for (let i = declarations_before; i < status.scoped_declarations.length; i++) {
 			const decl = status.scoped_declarations[i];
 			release_records_for_scope_exit(status, decl, moved);
-			if (moved.has(decl.name)) continue;
+			if (moved.has(decl.name)) {
+				emit_moved_local_cleanup(status, decl);
+				continue;
+			}
 			const scope_enum = status.enums.find((e) => e.name === decl.type.name && e.has_associated_data);
 			if (scope_enum && !decl.type.is_array) {
 				emit_enum_payload_frees(status, scope_enum.name, decl.name);
@@ -17674,7 +17939,10 @@ function emit_destroy_for_scope(status, declarations_before) {
 	for (let i = declarations_before; i < status.scoped_declarations.length; i++) {
 		const decl = status.scoped_declarations[i];
 		release_records_for_scope_exit(status, decl, moved);
-		if (moved.has(decl.name)) continue;
+		if (moved.has(decl.name)) {
+			emit_moved_local_cleanup(status, decl);
+			continue;
+		}
 		const scope_enum = status.enums.find((e) => e.name === decl.type.name && e.has_associated_data);
 		if (scope_enum && !decl.type.is_array) {
 			emit_enum_payload_frees(status, scope_enum.name, decl.name);
@@ -17799,11 +18067,31 @@ function emit_cleanup_to_loop_depth(status) {
 		}
 		const moved = status.moved ?? /* @__PURE__ */ new Set();
 		for (const entry of scope.struct_decls) {
-			if (moved.has(entry.name)) continue;
+			if (moved.has(entry.name)) {
+				if (status.mv_owns_flag?.get(entry.name) !== void 0) emit_moved_local_cleanup(status, {
+					name: entry.name,
+					type: {
+						name: entry.type_name,
+						type_args: entry.type_args,
+						is_nullable: entry.is_nullable
+					}
+				});
+				continue;
+			}
 			emit_destroy_for_decl(status, entry.name, entry.type_name, void 0, entry.type_args, entry.is_nullable);
 		}
 		for (const name of scope.heap_strings) {
-			if (moved.has(name)) continue;
+			if (moved.has(name)) {
+				const owns_flag = status.mv_owns_flag?.get(name);
+				if (owns_flag === void 0) continue;
+				const skip = `.Lskip_mvowns_${status.label_counter = (status.label_counter ?? 0) + 1}`;
+				emit_asm(status, `ldr x9, [x29, #${owns_flag}]\n`);
+				emit_asm(status, `cbnz x9, ${skip}\n`);
+				emit_var_load(status, "x0", name, 8);
+				emit_free(status);
+				emit_asm(status, `${skip}:\n`);
+				continue;
+			}
 			if (status.heap_string_arrays?.has(name)) {
 				const registered = status.heap_string_arrays.get(name);
 				const len = Math.abs(registered);
@@ -17838,6 +18126,22 @@ function consolidate_temp_anchors$1(status, call_node, result_type_name) {
 		if (find_anchor_slot(status, pname) === void 0) continue;
 		if (!status.moved) status.moved = /* @__PURE__ */ new Set();
 		status.moved.add(pname);
+		mark_local_moved_flag(status, pname);
+	}
+}
+/**
+* Set an owning `mv` value-struct local's runtime moved flag (1 = moved out)
+* if it has one. Called from every move-marking path (call args, returns,
+* closure captures, tuple move owners) so the flag-guarded scope-exit destroy
+* skips the moved path and still reclaims the not-moved path.
+*/
+function mark_local_moved_flag(status, name) {
+	const flag = status.mv_owns_flag?.get(name);
+	if (flag !== void 0) {
+		emit_asm(status, `str x9, [sp, #-16]!\n`);
+		emit_asm(status, `mov x9, #1\n`);
+		emit_asm(status, `str x9, [x29, #${flag}]\n`);
+		emit_asm(status, `ldr x9, [sp], #16\n`);
 	}
 }
 function mark_moved_if_struct(value, status, opts) {
@@ -17856,10 +18160,12 @@ function mark_moved_if_struct(value, status, opts) {
 	if (is_struct || is_enum_with_data || is_trait) {
 		if (!status.moved) status.moved = /* @__PURE__ */ new Set();
 		status.moved.add(var_name);
+		mark_local_moved_flag(status, var_name);
 	}
 	if (opts?.for_return && status.heap_strings?.has(var_name)) {
 		if (!status.moved) status.moved = /* @__PURE__ */ new Set();
 		status.moved.add(var_name);
+		mark_local_moved_flag(status, var_name);
 	}
 }
 /**
@@ -20428,6 +20734,135 @@ function value_number_loops(body, ast_list, status, mutate_ast) {
 	};
 }
 //#endregion
+//#region ../src/build_aarch64/utils/box_clone.ts
+/**
+* Emit the `<Box_T>_box_clone` helper for a `Box<T>` mono — the aarch64 twin
+* of the C backend's ensure_box_clone (see build_c/utils/box_clone.ts for the
+* rationale). x0 = src wrapper (NULL-safe), returns the clone in x0: malloc +
+* byte copy + fresh copies of every pointee field the wrapper's destroy would
+* reclaim (plain strings, deep-copyable containers, nested boxes,
+* payload-copyable enums). Class/trait-referencing state stays SHARED — the
+* pre-existing bounded gap recorded in FOLLOWUP.md.
+*
+* The DEFINITION buffers into `status.box_clone_definitions` (flushed at file
+* scope by build.ts after the statement walk — the call sites are
+* mid-function-body: the specialized load_T emitters), deduped per TU via
+* `status.emitted_box_clones`. Returns the helper's symbol.
+*/
+function ensure_box_clone_aarch64(box_mono, status) {
+	if (!status.emitted_box_clones) status.emitted_box_clones = /* @__PURE__ */ new Set();
+	if (status.emitted_box_clones.has(box_mono.name)) return box_clone_fn_name(box_mono.name);
+	status.emitted_box_clones.add(box_mono.name);
+	const fn = box_clone_fn_name(box_mono.name);
+	const T_SIZE = get_struct_size(box_mono.name, status);
+	const scratch = { ...status };
+	scratch.asm_code_state = void 0;
+	scratch.code = "";
+	scratch.box_clone_definitions = void 0;
+	scratch.label_counter = status.label_counter ?? 0;
+	const null_label = `.Lbox_clone_null_${scratch.label_counter = (scratch.label_counter ?? 0) + 1}`;
+	emit_asm(scratch, `.p2align 2\n`);
+	emit_asm(scratch, `${fn}:\n`);
+	if (status.emit_mode === "system" && status.platform !== "windows") {
+		emit_asm(scratch, `.globl _${fn}\n`);
+		emit_asm(scratch, `_${fn} = ${fn}\n`);
+	}
+	emit_asm(scratch, `cbz x0, ${null_label}\n`);
+	emit_asm(scratch, `stp x29, x30, [sp, #-16]!\n`);
+	emit_asm(scratch, `stp x20, x21, [sp, #-16]!\n`);
+	emit_asm(scratch, `mov x20, x0\n`);
+	emit_asm(scratch, `mov x0, #${T_SIZE}\n`);
+	emit_malloc(scratch);
+	emit_asm(scratch, `mov x21, x0\n`);
+	emit_asm(scratch, `mov x0, x21\n`);
+	emit_asm(scratch, `mov x1, x20\n`);
+	emit_asm(scratch, `mov x2, #${T_SIZE}\n`);
+	emit_asm(scratch, `bl _memcpy\n`);
+	const pointee_type = box_pointee_type(box_mono);
+	if (pointee_type) emit_pointee_owned_copies_asm(scratch, pointee_type, "x21", get_field_offset(box_mono.name, "__value", status), /* @__PURE__ */ new Set());
+	emit_asm(scratch, `mov x0, x21\n`);
+	emit_asm(scratch, `ldp x20, x21, [sp], #16\n`);
+	emit_asm(scratch, `ldp x29, x30, [sp], #16\n`);
+	emit_asm(scratch, `ret\n`);
+	emit_asm(scratch, `${null_label}:\n`);
+	emit_asm(scratch, `ret\n`);
+	status.label_counter = scratch.label_counter;
+	status.box_clone_definitions = (status.box_clone_definitions ?? "") + (scratch.box_clone_definitions ?? "") + scratch.code;
+	return fn;
+}
+/**
+* Give the wrapper clone at `[base + acc]` fresh copies of every field its
+* destroy would free (x21 must stay valid: every arm clobbers only
+* caller-saved registers). Recurses through nested value-struct fields; a
+* nested Box field clones through its own helper.
+*/
+function emit_pointee_owned_copies_asm(scratch, type, base, acc, visiting) {
+	if (!type.name || type.is_ref || type.is_view || type.is_array || type.is_nullable) return;
+	if (type.name === "string") {
+		emit_asm(scratch, `ldr x0, [${base}, #${acc}]\n`);
+		const skip = `.Lbcs_${scratch.label_counter = (scratch.label_counter ?? 0) + 1}`;
+		emit_asm(scratch, `cbz x0, ${skip}\n`);
+		emit_strdup(scratch);
+		emit_asm(scratch, `str x0, [${base}, #${acc}]\n`);
+		emit_asm(scratch, `${skip}:\n`);
+		return;
+	}
+	const field_enum = scratch.enums.find((e) => e.name === type.name && e.has_associated_data);
+	if (field_enum) {
+		if (enum_copy_is_deep$1(field_enum, scratch)) emit_enum_payload_strdups_at(scratch, field_enum.name, base, acc);
+		return;
+	}
+	const pointee = resolve_struct_type(type, scratch);
+	if (!pointee || pointee.is_class) return;
+	if (visiting.has(pointee.name)) return;
+	visiting.add(pointee.name);
+	const strings_are_heap = box_pointee_strings_are_heap(pointee, scratch);
+	for (const field of clone_fields$1(pointee, scratch)) {
+		const offset = acc + get_field_offset_of_fields(clone_fields$1(pointee, scratch), field.name, scratch);
+		if (field.type.is_ref || field.type.is_view || field.type.is_array || field.type.is_nullable) continue;
+		const nested_box = box_field_mono(field.type, scratch);
+		if (nested_box) {
+			const nested_fn = ensure_box_clone_aarch64(nested_box, scratch);
+			emit_asm(scratch, `ldr x0, [${base}, #${offset}]\n`);
+			const skip = `.Lbcc_${scratch.label_counter = (scratch.label_counter ?? 0) + 1}`;
+			emit_asm(scratch, `cbz x0, ${skip}\n`);
+			emit_asm(scratch, `bl ${nested_fn}\n`);
+			emit_asm(scratch, `str x0, [${base}, #${offset}]\n`);
+			emit_asm(scratch, `${skip}:\n`);
+			continue;
+		}
+		if (field.type.name === "string" && strings_are_heap) {
+			emit_asm(scratch, `ldr x0, [${base}, #${offset}]\n`);
+			const skip = `.Lbcs_${scratch.label_counter = (scratch.label_counter ?? 0) + 1}`;
+			emit_asm(scratch, `cbz x0, ${skip}\n`);
+			emit_strdup(scratch);
+			emit_asm(scratch, `str x0, [${base}, #${offset}]\n`);
+			emit_asm(scratch, `${skip}:\n`);
+			continue;
+		}
+		const field_struct = resolve_struct_type(field.type, scratch);
+		if (field_struct && !field_struct.is_class && is_load_deep_copy_container(field_struct.name) && struct_needs_destroy(field_struct, scratch) && field_struct.functions.find((f) => f.name === "copy")) {
+			emit_asm(scratch, `add x8, ${base}, #${offset}\n`);
+			emit_asm(scratch, `add x0, ${base}, #${offset}\n`);
+			emit_asm(scratch, `bl ${field_struct.name}_copy\n`);
+			continue;
+		}
+		const nested_enum = scratch.enums.find((e) => e.name === field.type.name && e.has_associated_data);
+		if (nested_enum && enum_copy_is_deep$1(nested_enum, scratch)) {
+			emit_enum_payload_strdups_at(scratch, nested_enum.name, base, offset);
+			continue;
+		}
+		emit_pointee_owned_copies_asm(scratch, field.type, base, offset, visiting);
+	}
+}
+/** The fields the pointee's destroy reclaims: an OWNING struct's
+*  trait-declared fields are uniformly heap (the ctor strdup'd their
+*  defaults) and join the walk, mirroring emit_field_destroys'
+*  layout_fields merge. */
+function clone_fields$1(pointee, status) {
+	return pointee.is_class || owns_strings_uniformly(pointee) ? layout_fields(pointee, status) : pointee.fields;
+}
+//#endregion
 //#region ../src/build_aarch64/utils/owning_buffer_specialize.ts
 /**
 * Detect whether a monomorphized struct is a `Buffer_<T>` whose element type
@@ -20635,6 +21070,14 @@ function collect_transfer_fields(elem, status, base_offset = 0) {
 	let offset = 8;
 	for (const field of elem.fields) {
 		const size = get_type_size(field.type, status);
+		if (box_field_mono(field.type, status)) {
+			result.push({
+				offset: base_offset + offset,
+				size
+			});
+			offset += size;
+			continue;
+		}
 		if (!field.type.is_ref && !field.type.is_view && !field.type.is_array && !field.type.is_nullable) {
 			const field_struct = resolve_struct_type(field.type, status);
 			if (field_struct && !field_struct.is_class) {
@@ -20680,6 +21123,16 @@ function emit_load_deep_copy_fields$1(elem, status, sret, slot) {
 			continue;
 		}
 		if (!field.type.is_ref && !field.type.is_view && !field.type.is_array && !field.type.is_nullable && field.type.name !== "string") {
+			const box_mono = box_field_mono(field.type, status);
+			if (box_mono) {
+				const clone_fn = ensure_box_clone_aarch64(box_mono, status);
+				emit_asm(status, `add x0, ${sret}, #${offset}\n`);
+				emit_asm(status, `ldr x0, [x0]\n`);
+				emit_asm(status, `bl ${clone_fn}\n`);
+				emit_asm(status, `str x0, [${sret}, #${offset}]\n`);
+				offset += size;
+				continue;
+			}
 			const field_struct = resolve_struct_type(field.type, status);
 			if (field_struct && !field_struct.is_class && is_load_deep_copy_container(field_struct.name) && struct_needs_destroy(field_struct, status) && field_struct.functions.find((f) => f.name === "copy")) {
 				emit_asm(status, `add x8, ${sret}, #${offset}\n`);
@@ -22886,6 +23339,8 @@ function build_function_node$1(node, status) {
 	status.trait_class_frames = void 0;
 	const old_moved = status.moved;
 	status.moved = void 0;
+	const old_mv_owns_flag = status.mv_owns_flag;
+	status.mv_owns_flag = void 0;
 	status.access_pins = void 0;
 	status.forwarded_param_inits = void 0;
 	const param_regs = [
@@ -23453,7 +23908,7 @@ function build_function_node$1(node, status) {
 		let return_save;
 		if (need_guard || need_save) {
 			return_save = allocate_stack_space(status, returns_fat_pair ? 16 : 8);
-			if (returns_fat_pair) emit_asm(status, `stp x0, x1, [x29, #${return_save}]\n`);
+			if (returns_fat_pair) emit_return_pair_save(status, return_save);
 			else emit_asm(status, `str x0, [x29, #${return_save}]\n`);
 		}
 		for (const [name, info] of moved_param_save_slots) {
@@ -23481,7 +23936,7 @@ function build_function_node$1(node, status) {
 			if (need_guard) emit_asm(status, `${keep_prefix}_${name}:\n`);
 		}
 		if (need_guard || need_save) {
-			if (returns_fat_pair) emit_asm(status, `ldp x0, x1, [x29, #${return_save}]\n`);
+			if (returns_fat_pair) emit_return_pair_restore(status, return_save);
 			else emit_asm(status, `ldr x0, [x29, #${return_save}]\n`);
 		}
 	}
@@ -23520,6 +23975,7 @@ function build_function_node$1(node, status) {
 	}
 	status.scoped_declarations = old_scoped_declarations;
 	status.moved = old_moved;
+	status.mv_owns_flag = old_mv_owns_flag;
 	status.heap_string_fields = old_heap_string_fields;
 	status.heap_strings = old_heap_strings;
 	status.heap_string_arrays = old_heap_string_arrays;
@@ -23797,6 +24253,8 @@ function build_destroy_function(node, func, status) {
 	status.trait_class_frames = void 0;
 	const old_moved = status.moved;
 	status.moved = void 0;
+	const old_mv_owns_flag = status.mv_owns_flag;
+	status.mv_owns_flag = void 0;
 	const old_heap_string_arrays = status.heap_string_arrays;
 	status.heap_string_arrays = void 0;
 	const old_heap_class_arrays = status.heap_class_arrays;
@@ -23874,6 +24332,7 @@ function build_destroy_function(node, func, status) {
 	status.heap_strings = old_heap_strings;
 	status.trait_class_frames = old_trait_class_frames;
 	status.moved = old_moved;
+	status.mv_owns_flag = old_mv_owns_flag;
 	status.heap_string_arrays = old_heap_string_arrays;
 	status.heap_class_arrays = old_heap_class_arrays;
 	status.heap_array_vars = old_heap_array_vars;
@@ -24230,6 +24689,8 @@ function build_custom_init_function(node, func, status) {
 	status.trait_class_frames = void 0;
 	const old_moved = status.moved;
 	status.moved = void 0;
+	const old_mv_owns_flag = status.mv_owns_flag;
+	status.mv_owns_flag = void 0;
 	const old_heap_string_arrays = status.heap_string_arrays;
 	status.heap_string_arrays = void 0;
 	const old_heap_class_arrays = status.heap_class_arrays;
@@ -24547,6 +25008,7 @@ function build_custom_init_function(node, func, status) {
 	status.heap_strings = old_heap_strings;
 	status.trait_class_frames = old_trait_class_frames;
 	status.moved = old_moved;
+	status.mv_owns_flag = old_mv_owns_flag;
 	status.heap_string_arrays = old_heap_string_arrays;
 	status.heap_class_arrays = old_heap_class_arrays;
 	status.heap_array_vars = old_heap_array_vars;
@@ -24578,6 +25040,8 @@ function build_struct_functions$1(node, status) {
 		status.trait_class_frames = void 0;
 		const old_moved = status.moved;
 		status.moved = void 0;
+		const old_mv_owns_flag = status.mv_owns_flag;
+		status.mv_owns_flag = void 0;
 		const old_heap_string_arrays = status.heap_string_arrays;
 		status.heap_string_arrays = void 0;
 		const old_heap_class_arrays = status.heap_class_arrays;
@@ -24941,7 +25405,7 @@ function build_struct_functions$1(node, status) {
 			let return_save;
 			if (ret_is_class || need_save) {
 				return_save = allocate_stack_space(status, returns_fat_pair ? 16 : 8);
-				if (returns_fat_pair) emit_asm(status, `stp x0, x1, [x29, #${return_save}]\n`);
+				if (returns_fat_pair) emit_return_pair_save(status, return_save);
 				else emit_asm(status, `str x0, [x29, #${return_save}]\n`);
 			}
 			for (const [name, info] of moved_param_save_slots) {
@@ -24969,7 +25433,7 @@ function build_struct_functions$1(node, status) {
 				if (ret_is_class) emit_asm(status, `${keep_prefix}_${name}:\n`);
 			}
 			if (ret_is_class || need_save) {
-				if (returns_fat_pair) emit_asm(status, `ldp x0, x1, [x29, #${return_save}]\n`);
+				if (returns_fat_pair) emit_return_pair_restore(status, return_save);
 				else emit_asm(status, `ldr x0, [x29, #${return_save}]\n`);
 			}
 		}
@@ -24992,6 +25456,7 @@ function build_struct_functions$1(node, status) {
 		status.heap_strings = old_heap_strings;
 		status.trait_class_frames = old_trait_class_frames;
 		status.moved = old_moved;
+		status.mv_owns_flag = old_mv_owns_flag;
 		status.function_return_type = old_function_return_type;
 		status.heap_string_arrays = old_heap_string_arrays;
 		status.heap_class_arrays = old_heap_class_arrays;
@@ -28159,7 +28624,7 @@ function build_function_call_node$1(node, status) {
 		}
 	}
 	const is_struct = status.structs.find((s) => s.name === node.name && !s.is_simple_type);
-	mark_tuple_literal_move_owners(node, status);
+	mark_tuple_literal_move_owners(node, status, (name) => mark_local_moved_flag(status, name));
 	const func_name = is_struct ? node.mangled_name ?? `${node.name}_init` : emission_label(node.resolved_function ?? node);
 	if (is_struct?.is_class) {
 		const inner = box_ctor_direct_ctor_arg(node, status.structs);
@@ -28860,7 +29325,7 @@ function build_return_node$1(node, status, nir_value) {
 		const finalized = status.moved ?? /* @__PURE__ */ new Set();
 		for (const decl of all_scope_frames(status).flat()) {
 			if (finalized.has(decl.name)) {
-				release_heap_string_fields(status, decl.name, decl.type.name, decl.type.is_nullable);
+				emit_moved_local_cleanup(status, decl);
 				continue;
 			}
 			if (is_field_struct_borrow(decl)) continue;
@@ -28880,7 +29345,7 @@ function build_return_node$1(node, status, nir_value) {
 			const finalized = status.moved ?? /* @__PURE__ */ new Set();
 			for (const decl of all_scope_frames(status).flat()) {
 				if (finalized.has(decl.name)) {
-					release_heap_string_fields(status, decl.name, decl.type.name, decl.type.is_nullable);
+					emit_moved_local_cleanup(status, decl);
 					continue;
 				}
 				if (is_field_struct_borrow(decl)) continue;
@@ -29283,7 +29748,7 @@ function build_return_node$1(node, status, nir_value) {
 		emit_nursery_joins_on_return_a64(status);
 		for (const decl of all_scope_frames(status).flat()) {
 			if (finalized.has(decl.name)) {
-				release_heap_string_fields(status, decl.name, decl.type.name, decl.type.is_nullable);
+				emit_moved_local_cleanup(status, decl);
 				continue;
 			}
 			if (is_field_struct_borrow(decl)) continue;
@@ -29342,6 +29807,42 @@ function build_switch_node$1(node, status, nir) {
 	exit_scope_frame(status, old_scoped_declarations);
 }
 //#endregion
+//#region ../src/build_common/discarded_update_result.ts
+/**
+* The owned result type of a `while` POST-STATEMENT (update) expression whose
+* discarded value must be reclaimed once per iteration.
+*
+* This is the update-position twin of the checker's bare-statement `_disc_N`
+* hoist (`hoist_discarded_class_results`) — but the hoist itself cannot run
+* here: the update re-evaluates on every iteration, so wrapping it in a
+* one-shot declaration would run the call before the first condition check
+* and change loop semantics. Instead, each backend captures the fresh result
+* into a per-iteration temp and frees it in place.
+*
+* Predicate mirrors the hoist's: a free-function call (`func_call`) whose
+* result type is a class or an owning value struct (`string` included), or a
+* method call whose callee stamps `owned_return` (`mv out T`). A view / ref /
+* array result is a borrow — never an owner — and a nullable VALUE struct's
+* sret-plus-flag shape has no in-place free, so both stay out.
+*/
+function discarded_owned_result_type(node, table) {
+	let expr = node;
+	while (expr.node_type === "grouped") expr = expr.value;
+	const is_call = expr.node_type === "func_call";
+	const is_method = expr.node_type === "access" && expr.access.node_type === "access_func";
+	if (!is_call && !is_method) return void 0;
+	const access_func = is_method ? expr.access : null;
+	if (access_func && !access_func.owned_return) return void 0;
+	const t = is_call ? expr.type : access_func.type;
+	if (!t?.name || t.is_view || t.is_ref || t.is_array) return void 0;
+	if (t.name === "string") return t;
+	const struct = resolve_struct_type(t, table);
+	if (!struct) return void 0;
+	if (struct.is_class) return t;
+	if (t.is_nullable) return void 0;
+	if (struct_needs_destroy(struct, table)) return t;
+}
+//#endregion
 //#region ../src/build_aarch64/build_while_loop_node.ts
 let label_counter = 0;
 function reset_label_counter() {
@@ -29456,7 +29957,12 @@ function build_while_loop_node$1(node, status, nir, vector, unroll) {
 		build_block_with_cursor$1(node, nir?.body, status);
 		if (node.update) {
 			emit_asm(status, `${continue_label}:\n`);
+			const owned_update = discarded_owned_result_type(node.update, status);
 			build_node(node.update, status);
+			if (owned_update) {
+				ensure_newline(status);
+				emit_discarded_owned_result_free(status, owned_update);
+			}
 			ensure_newline(status);
 		}
 		emit_asm(status, `b ${start_label}\n`);
@@ -32136,6 +32642,102 @@ function end_code_scratch(status, saved) {
 	return scratch;
 }
 //#endregion
+//#region ../src/build_c/utils/box_clone.ts
+/**
+* Emit the `<Box_T>_box_clone` helper for a `Box<T>` mono (STRUCT_PLAN_3
+* Box-in-container fix): malloc a fresh wrapper, byte-copy the pointee, then
+* give the clone independent copies of every field the wrapper's destroy
+* would reclaim (the same field set `build_auto_destroy` walks — plain
+* strings, deep-copyable containers, nested boxes, payload-copyable enums).
+* Class/trait-referencing state (a raw class field, an enum with reference
+* payloads) cannot be duplicated and stays SHARED — the pre-existing bounded
+* gap, recorded in FOLLOWUP.md.
+*
+* The DEFINITION buffers into `status.box_clone_definitions` (flushed at file
+* scope by build_root_node — C may not nest a function definition inside the
+* struct-method body being emitted) with the prototype in headers, so
+* definition order never matters. Deduped per TU via
+* `status.emitted_box_clones`. Returns the helper's symbol.
+*/
+function ensure_box_clone(box_mono, status) {
+	if (!status.emitted_box_clones) status.emitted_box_clones = /* @__PURE__ */ new Set();
+	if (status.emitted_box_clones.has(box_mono.name)) return box_clone_fn_name(box_mono.name);
+	status.emitted_box_clones.add(box_mono.name);
+	const fn = box_clone_fn_name(box_mono.name);
+	status.headers += `struct ${box_mono.name} *${fn}(struct ${box_mono.name} *);\n`;
+	const out = [];
+	out.push(`struct ${box_mono.name} *${fn}(struct ${box_mono.name} *src)\n{\n`);
+	out.push(`if (!src) return 0;\n`);
+	out.push(`struct ${box_mono.name} *_dst = (struct ${box_mono.name} *)malloc(sizeof(struct ${box_mono.name}));\n`);
+	out.push(`*_dst = *src;\n`);
+	const pointee_type = box_pointee_type(box_mono);
+	if (pointee_type) emit_pointee_owned_copies("_dst->__value", pointee_type, status, /* @__PURE__ */ new Set(), out);
+	out.push(`return _dst;\n`);
+	out.push(`}\n`);
+	status.box_clone_definitions = (status.box_clone_definitions ?? "") + out.join("");
+	return fn;
+}
+/**
+* Give the wrapper clone at C lvalue `lv` fresh copies of every field its
+* destroy would free. Recurses through nested value-struct fields; a nested
+* Box field clones through its own helper (the same emit point, deduped).
+*/
+function emit_pointee_owned_copies(lv, type, status, visiting, out) {
+	if (!type.name || type.is_ref || type.is_view || type.is_array || type.is_nullable) return;
+	if (type.name === "string") {
+		out.push(`${lv} = ${lv}.ptr ? nomen_str_dup(${lv}) : ${lv};\n`);
+		return;
+	}
+	const field_enum = status.enums.find((e) => e.name === type.name && e.has_associated_data);
+	if (field_enum) {
+		if (enum_copy_is_deep$1(field_enum, status)) out.push(`${lv} = ${field_enum.name}_copy(${lv});\n`);
+		return;
+	}
+	const pointee = resolve_struct_type(type, status);
+	if (!pointee || pointee.is_class) return;
+	if (visiting.has(pointee.name)) return;
+	visiting.add(pointee.name);
+	const strings_are_heap = box_pointee_strings_are_heap(pointee, status);
+	for (const field of clone_fields(pointee, status)) {
+		if (field.type.is_ref || field.type.is_view || field.type.is_array || field.type.is_nullable) continue;
+		const flv = `${lv}.${field.name}`;
+		const nested_box = box_field_mono(field.type, status);
+		if (nested_box) {
+			const nested_fn = ensure_box_clone(nested_box, status);
+			out.push(`${flv} = ${nested_fn}(${flv});\n`);
+			continue;
+		}
+		if (field.type.name === "string" && !field.type.is_array && strings_are_heap) {
+			out.push(`${flv} = ${flv}.ptr ? nomen_str_dup(${flv}) : ${flv};\n`);
+			continue;
+		}
+		const field_struct = resolve_struct_type(field.type, status);
+		if (field_struct && !field_struct.is_class && is_load_deep_copy_container(field_struct.name) && struct_needs_destroy(field_struct, status) && field_struct.functions.find((f) => f.name === "copy")) {
+			out.push(`${flv} = ${field_struct.name}_copy(&${flv});\n`);
+			continue;
+		}
+		const nested_enum = status.enums.find((e) => e.name === field.type.name && e.has_associated_data);
+		if (nested_enum && enum_copy_is_deep$1(nested_enum, status)) {
+			out.push(`${flv} = ${nested_enum.name}_copy(${flv});\n`);
+			continue;
+		}
+		emit_pointee_owned_copies(flv, field.type, status, visiting, out);
+	}
+}
+/** The fields the pointee's destroy reclaims: an OWNING struct's
+*  trait-declared fields are uniformly heap (the ctor strdup'd their
+*  defaults) and join the walk, mirroring `class_destroy_fields`. */
+function clone_fields(pointee, status) {
+	if (!owns_strings_uniformly(pointee) || !pointee.traits.length) return pointee.fields;
+	const extra = [];
+	for (const trait_name of pointee.traits) {
+		const trait = status.traits.find((t) => t.name === trait_name);
+		if (!trait) continue;
+		for (const f of trait.fields) if (!pointee.fields.find((nf) => nf.name === f.name)) extra.push(f);
+	}
+	return extra.length ? [...pointee.fields, ...extra] : pointee.fields;
+}
+//#endregion
 //#region ../src/build_c/utils/owning_buffer_specialize.ts
 /**
 * Detect whether a monomorphized struct is a `Buffer_<T>` whose element type
@@ -32214,10 +32816,14 @@ const OWNING_BUFFER_METHODS = /* @__PURE__ */ new Set([
 function emit_transfer_owning_fields(elem, src, status, prefix = "") {
 	for (const field of elem.fields) {
 		if (field.type.is_ref || field.type.is_view) continue;
+		const src_field = `${prefix}${src}${arrow(src)}${field.name}`;
+		if (box_field_mono(field.type, status)) {
+			status.code += `memset((void*)&${src_field}, 0, sizeof(${src_field}));\n`;
+			continue;
+		}
 		if (field.type.is_array || field.type.is_nullable) continue;
 		const field_struct = resolve_struct_type(field.type, status);
 		if (!field_struct || field_struct.is_class) continue;
-		const src_field = `${prefix}${src}${arrow(src)}${field.name}`;
 		if (has_destroy(field_struct)) status.code += `memset((void*)&${src_field}, 0, sizeof(${src_field}));\n`;
 		else if (struct_needs_destroy(field_struct, status)) emit_transfer_owning_fields(field_struct, src_field, status, "");
 	}
@@ -32241,6 +32847,12 @@ function emit_load_deep_copy_fields(elem, dst, status) {
 		if (field.type.is_ref || field.type.is_view || field.type.is_array) continue;
 		if (field.type.is_nullable) continue;
 		if (field.type.name === "string") continue;
+		const box_mono = box_field_mono(field.type, status);
+		if (box_mono) {
+			const clone_fn = ensure_box_clone(box_mono, status);
+			status.code += `${dst}.${field.name} = ${clone_fn}(${dst}.${field.name});\n`;
+			continue;
+		}
 		const field_struct = resolve_struct_type(field.type, status);
 		if (field_struct && !field_struct.is_class && is_load_deep_copy_container(field_struct.name) && struct_needs_destroy(field_struct, status) && field_struct.functions.find((f) => f.name === "copy")) {
 			status.code += `${dst}.${field.name} = ${field_struct.name}_copy(&${dst}.${field.name});\n`;
@@ -32266,6 +32878,11 @@ function emit_load_owned_copies_destroy(status, elem, var_expr) {
 		if (field.type.is_ref || field.type.is_view || field.type.is_array) continue;
 		if (field.type.is_nullable) continue;
 		if (field.type.name === "string") continue;
+		const box_mono = box_field_mono(field.type, status);
+		if (box_mono) {
+			status.code += `if (${var_expr}.${field.name}) { ${box_mono.name}_destroy(${var_expr}.${field.name}); free(${var_expr}.${field.name}); }\n`;
+			continue;
+		}
 		const field_struct = resolve_struct_type(field.type, status);
 		if (field_struct && !field_struct.is_class && is_load_deep_copy_container(field_struct.name) && struct_needs_destroy(field_struct, status) && field_struct.functions.find((f) => f.name === "copy")) {
 			status.code += `${field_struct.name}_destroy(&${var_expr}.${field.name});\n`;
@@ -32723,6 +33340,10 @@ function build_auto_free(status) {
 * (those are scope-exit-only concerns handled by build_auto_free).
 */
 function free_scoped_declarations(status, decls, persist_string_field_records = false) {
+	if (status.pending_mv_owns_sets?.length) {
+		status.code += status.pending_mv_owns_sets.join("\n") + "\n";
+		status.pending_mv_owns_sets.length = 0;
+	}
 	let commented = false;
 	if (status.heap_string_fields?.size) for (const dec of decls) {
 		if (dec.moved_value_struct_param) {
@@ -32824,6 +33445,7 @@ function free_scoped_declarations(status, decls, persist_string_field_records =
 		const is_heap_string_assign = !!status.heap_strings?.has(dec.name);
 		const dec_struct = status.structs.find((s) => s.name === dec.type.name);
 		const is_class_var = !!dec_struct?.is_class;
+		const mv_owns_flag = status.c_mv_owns_flags?.get(dec.name);
 		const trait_class_trait = dec.trait_class_trait;
 		if (trait_class_trait !== void 0 && !is_destructured_field_access) {
 			if (!commented) {
@@ -32840,7 +33462,8 @@ function free_scoped_declarations(status, decls, persist_string_field_records =
 				status.code += "\n// Auto-free\n";
 				commented = true;
 			}
-			status.code += `free(${cname}.ptr);\n`;
+			if (mv_owns_flag !== void 0) status.code += `if (!${mv_owns_flag}) { free(${cname}.ptr); }\n`;
+			else status.code += `free(${cname}.ptr);\n`;
 		}
 		if (!is_destructured_field_access && !dec.type.is_array) {
 			const enum_node = status.enums.find((e) => e.name === dec.type.name);
@@ -32866,7 +33489,8 @@ function free_scoped_declarations(status, decls, persist_string_field_records =
 			if (cls) {
 				const destroy_call = has_destroy_fn ? `${mono_cls_name}_destroy(${cname}); ` : "";
 				const alias_flag = status.c_alias_owns_flags?.get(dec.name);
-				if (alias_flag !== void 0) status.code += `if (${alias_flag}) { ${destroy_call}free(${cname}); }\n`;
+				if (mv_owns_flag !== void 0) status.code += `if (!${mv_owns_flag}) { ${destroy_call}free(${cname}); }\n`;
+				else if (alias_flag !== void 0) status.code += `if (${alias_flag}) { ${destroy_call}free(${cname}); }\n`;
 				else if (dec.type.is_nullable) status.code += `if (${cname}) { ${destroy_call}free(${cname}); }\n`;
 				else status.code += `${destroy_call}free(${cname});\n`;
 			} else status.code += `free(${cname});\n`;
@@ -32879,7 +33503,11 @@ function free_scoped_declarations(status, decls, persist_string_field_records =
 					status.code += "\n// Auto-free\n";
 					commented = true;
 				}
-				emit_struct_destroys(status, struct_type, cname);
+				if (mv_owns_flag !== void 0) {
+					status.code += `if (!${mv_owns_flag}) { `;
+					emit_struct_destroys(status, struct_type, cname);
+					status.code += `}\n`;
+				} else emit_struct_destroys(status, struct_type, cname);
 			}
 		}
 		if (dec.trait_class_trait === void 0 && !!status.traits.find((t) => t.name === dec.type.name) && !is_destructured_field_access && !dec.type.is_array && dec.value) {
@@ -34441,7 +35069,12 @@ function build_assignment_node$1(node, status, nir_rhs, nir_swap) {
 						release_recorded_string_fields(status, move_struct_type, lhs_name);
 						if (struct_needs_destroy_by_name(move_struct_type.name, status)) emit_struct_destroys(status, move_struct_type, lhs_name);
 					}
-					splice_decl_from_c_scopes(status, rhs.value);
+					const mv_donor_name = rhs.value;
+					const mv_donor_flag = status.c_mv_owns_flags?.get(mv_donor_name);
+					if (!!mv_donor_flag && move_struct_type?.is_owning === true && !move_struct_type.name.startsWith("_Tuple_") && !move_struct_type.name.startsWith("_Anon_") && !node.swap) {
+						if (!status.pending_mv_owns_sets) status.pending_mv_owns_sets = [];
+						status.pending_mv_owns_sets.push(`${mv_donor_flag} = 1;`);
+					} else splice_decl_from_c_scopes(status, mv_donor_name);
 				} else if (rhs_is_base_literal) {
 					const struct_type = lhs_mono_struct ?? lhs_struct;
 					if (struct_type) {
@@ -35298,6 +35931,19 @@ function build_declaration_node$1(node, status, nir_init, nir_swap) {
 			if (node.type?.name === "string" && !node.type.is_array) {
 				if (!status.owned_string_vars) status.owned_string_vars = /* @__PURE__ */ new Set();
 				status.owned_string_vars.add(safe_name);
+				if (!node.is_module_init) {
+					const flag = `_mv_owns_${safe_name}`;
+					status.code += `unsigned char ${flag} = 0;\n`;
+					if (!status.c_mv_owns_flags) status.c_mv_owns_flags = /* @__PURE__ */ new Map();
+					status.c_mv_owns_flags.set(node.name, flag);
+				}
+			}
+			const mv_decl_struct = node.type?.name ? status.structs.find((s) => s.name === mono_type_name(node.type) && !s.is_simple_type && !s.is_generic) : void 0;
+			if (mv_decl_struct?.is_owning === true && !mv_decl_struct.name.startsWith("_Tuple_") && !mv_decl_struct.name.startsWith("_Anon_") && !node.type.is_nullable && struct_needs_destroy_by_name(mv_decl_struct.name, status)) {
+				const flag = `_mv_owns_${safe_name}`;
+				status.code += `unsigned char ${flag} = 0;\n`;
+				if (!status.c_mv_owns_flags) status.c_mv_owns_flags = /* @__PURE__ */ new Map();
+				status.c_mv_owns_flags.set(node.name, flag);
 			}
 		} else {
 			if (!status.class_alias_vars) status.class_alias_vars = /* @__PURE__ */ new Set();
@@ -36159,16 +36805,20 @@ function build_return_node(node, status, nir_value) {
 		}
 	}
 	let returned_value_decl;
+	let moved_string_flag;
 	let returned_recorded_string_fields;
 	if (node.value.node_type === "value") {
 		const value = node.value.value;
 		returned_value_decl = find_decl_across_scopes(value, status);
-		const frames = [status.scoped_declarations, ...status.c_scope_stack ?? []];
-		for (const frame of frames) {
-			const di = frame.indexOf(returned_value_decl);
-			if (di !== -1) {
-				frame.splice(di, 1);
-				break;
+		moved_string_flag = returned_value_decl && returned_value_decl.type?.name === "string" && !returned_value_decl.type?.is_array && !returned_value_decl.type?.is_view ? status.c_mv_owns_flags?.get(value) : void 0;
+		if (!moved_string_flag) {
+			const frames = [status.scoped_declarations, ...status.c_scope_stack ?? []];
+			for (const frame of frames) {
+				const di = frame.indexOf(returned_value_decl);
+				if (di !== -1) {
+					frame.splice(di, 1);
+					break;
+				}
 			}
 		}
 		if (status.heap_string_fields?.size) {
@@ -36232,6 +36882,7 @@ function build_return_node(node, status, nir_value) {
 		status.code += `${old_return_assign} = `;
 		emit_return_value(node.value, nir_value, status);
 		status.code += `;\n`;
+		if (moved_string_flag) status.code += `${moved_string_flag} = 1;\n`;
 		reclaim_all_c_scopes(status);
 	} else if ((status.function_return_type?.name ?? node.type?.name) === "void" && !node.type?.is_array) {
 		emit_allocations(node.value, status);
@@ -36379,6 +37030,7 @@ function build_return_node(node, status, nir_value) {
 				status.code += `_return_val.${field.name} = nomen_str_dup(_return_val.${field.name});\n`;
 			}
 		}
+		if (moved_string_flag) status.code += `${moved_string_flag} = 1;\n`;
 		emit_nursery_joins_on_return_c(status);
 		reclaim_all_c_scopes(status);
 		status.code += `return _return_val;\n`;
@@ -36545,13 +37197,41 @@ function build_while_loop_node(node, status, nir) {
 		}
 		return true;
 	};
+	const build_update_expr = () => {
+		if (!node.update) return;
+		const owned = discarded_owned_result_type(node.update, status);
+		if (!owned) {
+			build_node$1(node.update, status);
+			return;
+		}
+		const mono = mono_type_name(owned);
+		const struct = status.structs.find((s) => s.name === mono && !s.is_generic);
+		const free_fn = status.audit ? "nomen_free_wrap" : "free";
+		const tmp = `_upd_${status.label_counter = (status.label_counter ?? 0) + 1}`;
+		status.code += `({ `;
+		if (struct?.is_class) {
+			status.code += `struct ${mono} *${tmp} = `;
+			build_node$1(node.update, status);
+			status.code += `; if (${tmp}) { ${mono}_destroy(${tmp}); ${free_fn}(${tmp}); }; `;
+		} else if (mono === "string") {
+			status.code += `nomen_string ${tmp} = `;
+			build_node$1(node.update, status);
+			status.code += `; ${free_fn}(${tmp}.ptr); `;
+		} else if (struct) {
+			status.code += `struct ${mono} ${tmp} = `;
+			build_node$1(node.update, status);
+			status.code += `; `;
+			emit_struct_destroys(status, struct, tmp);
+		}
+		status.code += ` })`;
+	};
 	if (node.update) {
 		status.code += `for (; `;
 		const has_reeval = emit_condition_reeval();
 		build_condition(node.condition, status);
 		if (has_reeval) status.code += `; })`;
 		status.code += `; `;
-		build_node$1(node.update, status);
+		build_update_expr();
 		status.code += `) {\n`;
 	} else {
 		status.code += `while (`;
@@ -36766,6 +37446,10 @@ function with_semicolon_tail(status, node) {
 		status.code += status.pending_string_releases.join("\n") + "\n";
 		status.pending_string_releases.length = 0;
 	}
+	if (status.pending_mv_owns_sets?.length) {
+		status.code += status.pending_mv_owns_sets.join("\n") + "\n";
+		status.pending_mv_owns_sets.length = 0;
+	}
 }
 /**
 * NIR-level EXPRESSION emission (phase 4, canonical-IR stage 2+ — the C
@@ -37788,6 +38472,8 @@ function build_function_node(node, status) {
 	status.deferred_frees = [];
 	const old_alias_owns_flags = status.c_alias_owns_flags;
 	status.c_alias_owns_flags = /* @__PURE__ */ new Map();
+	const old_mv_owns_flags = status.c_mv_owns_flags;
+	status.c_mv_owns_flags = /* @__PURE__ */ new Map();
 	const old_alias_decl_frames = status.alias_decl_frames;
 	status.alias_decl_frames = /* @__PURE__ */ new Map();
 	const old_class_alias_vars = status.class_alias_vars;
@@ -37812,6 +38498,8 @@ function build_function_node(node, status) {
 	status.stack_array_lengths = void 0;
 	const old_moved = status.moved;
 	status.moved = /* @__PURE__ */ new Set();
+	const old_pending_mv_owns = status.pending_mv_owns_sets;
+	status.pending_mv_owns_sets = void 0;
 	const old_borrow_only = status.c_borrow_only_strings;
 	status.c_borrow_only_strings = scan_borrow_only_strings(node);
 	const old_force_heap = status.force_heap_strings;
@@ -38028,6 +38716,8 @@ function build_function_node(node, status) {
 	status.c_borrow_only_strings = old_borrow_only;
 	status.force_heap_strings = old_force_heap;
 	status.c_alias_owns_flags = old_alias_owns_flags;
+	status.c_mv_owns_flags = old_mv_owns_flags;
+	status.pending_mv_owns_sets = old_pending_mv_owns;
 	status.alias_decl_frames = old_alias_decl_frames;
 	status.class_alias_vars = old_class_alias_vars;
 	status.class_alias_source_map = old_class_alias_source_map;
@@ -38676,12 +39366,14 @@ function build_function_call_node(node, status) {
 			if (tname && status.enums.find((e) => e.name === tname && e.has_associated_data)) continue;
 			const decl_struct = decl_hit ? status.structs.find((s) => s.name === tname && !s.is_simple_type) : void 0;
 			const is_value_struct = !!decl_struct && !decl_struct.is_class;
-			if (decl_hit) decl_hit.frame.splice(decl_hit.index, 1);
+			const prefix = `${vname}.`;
+			const box_ctor_transfer = is_box_type(node.name, status.structs);
+			const callee_move_param = !!node.resolved_function?.params?.filter((p) => !p.is_self_param)[idx]?.is_moved;
+			const transfer = box_ctor_transfer || (node.move_owned_param_indices?.includes(idx) ?? false) || callee_move_param;
+			const owns_flag = status.c_mv_owns_flags?.get(vname);
+			const use_flag = !!owns_flag && is_value_struct && transfer && decl_struct?.is_owning === true && !decl_struct.name.startsWith("_Tuple_") && !decl_struct.name.startsWith("_Anon_");
+			if (decl_hit && !use_flag) decl_hit.frame.splice(decl_hit.index, 1);
 			if (is_value_struct) {
-				const prefix = `${vname}.`;
-				const box_ctor_transfer = is_box_type(node.name, status.structs);
-				const callee_move_param = !!node.resolved_function?.params?.filter((p) => !p.is_self_param)[idx]?.is_moved;
-				const transfer = box_ctor_transfer || (node.move_owned_param_indices?.includes(idx) ?? false) || callee_move_param;
 				for (const key of Array.from(status.heap_string_fields ?? [])) if (key.startsWith(prefix)) {
 					if (!transfer) {
 						if (!status.pending_string_releases) status.pending_string_releases = [];
@@ -38690,6 +39382,11 @@ function build_function_call_node(node, status) {
 					status.heap_string_fields.delete(key);
 				}
 			}
+			if (use_flag) {
+				if (!status.pending_mv_owns_sets) status.pending_mv_owns_sets = [];
+				status.pending_mv_owns_sets.push(`${owns_flag} = 1;`);
+				continue;
+			}
 			if (!status.moved) status.moved = /* @__PURE__ */ new Set();
 			status.moved.add(vname);
 		}
@@ -39852,6 +40549,10 @@ function build_root_node(node, status) {
 		status.code += status.closure_definitions;
 		status.closure_definitions = void 0;
 	}
+	if (status.box_clone_definitions) {
+		status.code += status.box_clone_definitions;
+		status.box_clone_definitions = void 0;
+	}
 	if ((/\bobjc_msgSend\b|\bobjc_getClass\b|\bsel_registerName\b/.test(status.code) || /\bobjc_msgSend\b|\bobjc_getClass\b|\bsel_registerName\b/.test(status.headers)) && (status.platform === "macos" || status.platform === "ios")) status.headers = "#import <Foundation/Foundation.h>\n#include <objc/runtime.h>\n#include <objc/message.h>\n" + (status.platform === "macos" ? `#import <Cocoa/Cocoa.h>\n` : `#import <UIKit/UIKit.h>\n`) + status.headers;
 	status.headers += "void **_get_trait_func(void **obj, int trait_index, int func_index);\n";
 	if (status.emit_mode !== "user") status.code += `
@@ -40070,6 +40771,10 @@ function build_node$1(node, status, with_semicolon = false) {
 			status.code += status.pending_string_releases.join("\n") + "\n";
 			status.pending_string_releases.length = 0;
 		}
+		if (status.pending_mv_owns_sets?.length) {
+			status.code += status.pending_mv_owns_sets.join("\n") + "\n";
+			status.pending_mv_owns_sets.length = 0;
+		}
 	}
 }
 //#endregion
@@ -41248,6 +41953,7 @@ function emit_capturing_closure_value_a64(fn, status) {
 		if (cap.is_move && !(cap.type.name === "string" && !cap.type.is_view && !cap.type.is_array)) {
 			if (!status.moved) status.moved = /* @__PURE__ */ new Set();
 			status.moved.add(cap.name);
+			mark_local_moved_flag(status, cap.name);
 			const prefix = `${cap.name}.`;
 			for (const key of Array.from(status.heap_string_fields ?? [])) if (key.startsWith(prefix)) status.heap_string_fields.delete(key);
 		}
@@ -41666,7 +42372,7 @@ function emit_struct_constructor_to_slot(fc, slot_addr, status) {
 * so register slots start at x1 — overflow begins at the 8th arg (slot 8).
 */
 function build_constructor_params(fc, param_regs, status) {
-	mark_tuple_literal_move_owners(fc, status);
+	mark_tuple_literal_move_owners(fc, status, (name) => mark_local_moved_flag(status, name));
 	const variadic_idx = fc.variadic_param_index;
 	if (variadic_idx !== void 0 && fc.params[variadic_idx] && fc.params[variadic_idx].node_type === "array") {
 		const arr = fc.params[variadic_idx];
@@ -42988,6 +43694,12 @@ function build_declaration_node(node, status, nir_init, nir_swap) {
 				const offset = allocate_stack_space(status, total_size);
 				status.stack_offsets.set(node.name, offset);
 				if (nullable_struct) status.stack_offsets.set(has_flag_name(node.name), offset + struct_size);
+				if (struct_type?.is_owning === true && !nullable_struct && !struct_type.name.startsWith("_Tuple_") && !struct_type.name.startsWith("_Anon_") && struct_needs_destroy(struct_type, status)) {
+					const owns_flag_offset = allocate_stack_space(status, 8, 8);
+					emit_asm(status, `str xzr, [x29, #${owns_flag_offset}]\n`);
+					if (!status.mv_owns_flag) status.mv_owns_flag = /* @__PURE__ */ new Map();
+					status.mv_owns_flag.set(node.name, owns_flag_offset);
+				}
 			} else if (node.is_module_init) {
 				emit_data(status, ".data\n");
 				emit_data(status, `.p2align 3\n${node.name}: .space ${total_size}\n`);
@@ -43731,10 +44443,27 @@ function emit_rhs_value(rhs, nir, status) {
 * `a = b swap <rep>` / `var X b = mv f swap <rep>`): the expression-seam
 * version of the historical `build_node(swap)`. Both callers normalize the
 * trailing newline immediately after, so the helper does it.
+*
+* The replacement is an ordinary expression COMPOSED INTO the enclosing
+* statement — never the enclosing function's return value — so a
+* value-struct-returning call in it (most commonly the fresh `T()` a swap
+* constructs) must build into a fresh stack temp, not the sret buffer.
+* `status.struct_return_buffer` is left set for the WHOLE body of an
+* sret-returning function, so without this it pointed the replacement's
+* destination at the caller's saved sret pointer and built the value through
+* it — corrupting the caller's frame (and, in the allmark parser's
+* `result.arena = mv inline_state.arena swap Arena<...>()`, the returned
+* structure's node arena, which later crashed in `#destroy`).
 */
 function emit_swap_value(swap, nir, status) {
+	const old_buffer = status.struct_return_buffer;
+	const old_offset = status.return_buffer_stack_offset;
+	status.struct_return_buffer = void 0;
+	status.return_buffer_stack_offset = void 0;
 	if (nir && nir.node === swap) emit_expr_from_nir$1(nir, status);
 	else build_node(swap, status);
+	status.struct_return_buffer = old_buffer;
+	status.return_buffer_stack_offset = old_offset;
 	ensure_newline(status);
 }
 function build_nullable_struct_assignment(node, status, nir_rhs) {
@@ -44650,6 +45379,11 @@ function build_assignment_node(node, status, nir_rhs, nir_swap) {
 				if (!status.heap_strings) status.heap_strings = /* @__PURE__ */ new Set();
 				status.heap_strings.add(name);
 			} else if (explicit_move_source !== void 0 && status.heap_strings?.delete(explicit_move_source)) status.heap_strings.add(name);
+			if (lhs_is_heap && size === 16 && !status.heap_strings?.has(name)) {
+				emit_strdup_string(status);
+				if (!status.heap_strings) status.heap_strings = /* @__PURE__ */ new Set();
+				status.heap_strings.add(name);
+			}
 			emit_asm(status, `\n`);
 			emit_var_store(status, "x0", name, size);
 		}
@@ -50388,6 +51122,10 @@ function build(root, options = {}) {
 		status.borrow_returning_functions = scan_borrow_returning_functions(root);
 		status.inline_functions = scan_inline_candidates(root);
 		build_node(root, status);
+		if (status.box_clone_definitions) {
+			status.code += status.box_clone_definitions;
+			status.box_clone_definitions = void 0;
+		}
 		const emitted_trait_destroys = /* @__PURE__ */ new Set();
 		for (const trait of status.traits) {
 			if (emitted_trait_destroys.has(trait.name)) continue;
@@ -52696,6 +53434,50 @@ function enum_owns_payloads(en, status, visited) {
 	for (const c of en.cases) for (const p of c.params) if (type_owns_heap(p.type, status)) return true;
 	return false;
 }
+/**
+* The parameter of the enclosing function named `name`, if any (a bare-name
+* donor lookup — mirrors the field-store rule's enclosing-func resolution).
+*/
+function enclosing_function_param(status, name) {
+	if (!name) return void 0;
+	return status.stack.findLast((n) => n.node_type === "func")?.params.find((p) => p.name === name && !p.is_self_param);
+}
+/**
+* The B3 borrow contract for a BARE (non-`mv`) parameter of an owning mv
+* struct type: the call boundary does NOT materialize a private deep copy
+* (that is the pass-by-value convention's row, which declared-`mv` structs
+* are excluded from), so the parameter's storage aliases the caller's heap
+* fields and the caller keeps ownership. The callee may READ the parameter
+* but must never transfer ownership out of it — any transfer (`mv p` into a
+* declaration/assignment/owning parameter, with or without a swap: the swap
+* revalidates the callee's copy, not the caller's original; a by-value
+* `return p`; an implicit-mv boxing) hands the destination ownership the
+* caller's scope-exit destroy still reclaims (a double free). The fix at the
+* use site is to declare the parameter `mv` — which forces the call-site
+* `mv` keyword and invalidates the donor — or to `.copy()` it.
+*
+* Flagged only when the aliased bytes actually carry owned heap:
+*   - a declared-`mv` struct whose fields transitively own heap (a string
+*     field, a resource-releasing `#destroy`, a class/nested-owning field) —
+*     a scalar-field `mv struct` aliases harmlessly and keeps the plain
+*     by-value convention;
+*   - an undeclared struct owning non-string heap (its locals are
+*     auto-destroyed, and the boundary is an alias, not a copy).
+*
+* Exempt: `mv`/`ref`/`view`/`self` parameters, non-struct types, simple
+* types (`string` is a declared mv struct, but a string parameter's boundary
+* materializes a private deep copy, so moving one out never aliases), and
+* undeclared string-only structs (the pass-by-value deep copy).
+*/
+function borrowed_param_transfer_error(param, status) {
+	if (!param || param.is_moved || param.is_self_param) return void 0;
+	if (param.type.is_ref || param.type.is_view) return void 0;
+	if (!param.type.name) return void 0;
+	const s = status.structs.find((st) => st.name === param.type.name && !st.is_simple_type && !st.is_class);
+	if (!s) return void 0;
+	if (!(s.is_owning ? struct_owns_heap(s, status, /* @__PURE__ */ new Set()) : struct_owns_non_string_heap(s, status, /* @__PURE__ */ new Set()))) return void 0;
+	return `cannot transfer ownership out of parameter '${param.name}' — a bare parameter of mv struct type '${param.type.name}' is a borrow; declare it 'mv' (and pass it with 'mv' at the call site), or .copy() it`;
+}
 //#endregion
 //#region ../src/check/utils/captures.ts
 /**
@@ -55749,9 +56531,13 @@ function check_declaration_node(decl, status) {
 					} else add_error(status, `cannot copy a trait handle — use 'mv ${src_name}' to transfer it, or box a fresh instance`, decl.value.start);
 				} else if (src_sv && (src_sv.type.is_ref || src_sv.type.is_view)) add_error(status, boxing_owns_error(), decl.value.start);
 				else if (src_sv && is_value_struct_conformer(src_sv.type.name, decl.type.name, status)) {
-					if (!decl.value.is_moved) decl.value.is_moved = true;
-					if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
-					status.moved_variables.add(src_name);
+					const boxing_param_error = borrowed_param_transfer_error(enclosing_function_param(status, src_name), status);
+					if (boxing_param_error) add_error(status, boxing_param_error, decl.value.start);
+					else {
+						if (!decl.value.is_moved) decl.value.is_moved = true;
+						if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
+						status.moved_variables.add(src_name);
+					}
 				}
 			} else if (is_trait_type(decl.type.name, status) && !decl.type.is_array && !decl.type.is_ref && !decl.type.is_view && decl.value.node_type !== "func_call" && decl.value.node_type !== "value") {
 				if (is_value_struct_conformer(type_from_value_node(decl.value, status).name, decl.type.name, status)) add_error(status, boxing_owns_error(), decl.value.start);
@@ -55814,12 +56600,16 @@ function check_declaration_node(decl, status) {
 				} else if (check_node(decl.swap, status)) check_type_and_value_match(field_type, type_from_value_node(decl.swap, status), void 0, status, decl.swap.start, "swap");
 			}
 		}
-		if (decl.value?.node_type === "value" && decl.value.is_moved && !decl.swap) {
-			if (status.values.findLast((v) => v.name === decl.value.value)?.is_ref_binding) add_error(status, `'${decl.value.value}' is a ref — mv the owner instead`, decl.value.start);
-			else {
-				enforce_root_not_frozen(decl.value.value, status, decl.value.start);
-				if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
-				status.moved_variables.add(decl.value.value);
+		if (decl.value?.node_type === "value" && decl.value.is_moved) {
+			const transfer_error = borrowed_param_transfer_error(enclosing_function_param(status, decl.value.value), status);
+			if (transfer_error) add_error(status, transfer_error, decl.value.start);
+			else if (!decl.swap) {
+				if (status.values.findLast((v) => v.name === decl.value.value)?.is_ref_binding) add_error(status, `'${decl.value.value}' is a ref — mv the owner instead`, decl.value.start);
+				else {
+					enforce_root_not_frozen(decl.value.value, status, decl.value.start);
+					if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
+					status.moved_variables.add(decl.value.value);
+				}
 			}
 		}
 		check_constraint(decl, status);
@@ -60350,9 +61140,13 @@ function check_function_call(node, status, func, target_type, self_value, self_p
 		else if (!func_param.is_moved && has_mov_keyword) add_error(status, `Unexpected 'mv' keyword for non-mv parameter '${func_param.name}'`, param.start);
 		if (has_mov_keyword && param_value && !node.swap_params?.has(i)) {
 			if (func_param.type.name && (is_class_type$1(func_param.type.name, status) || !!status.traits.find((t) => t.name === func_param.type.name) || func_param.is_moved && is_owning_struct_type(func_param.type, status))) {
-				enforce_root_not_frozen(param_value, status, param.start);
-				if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
-				status.moved_variables.add(param_value);
+				const transfer_error = borrowed_param_transfer_error(enclosing_function_param(status, param_value), status);
+				if (transfer_error) add_error(status, transfer_error, param.start);
+				else {
+					enforce_root_not_frozen(param_value, status, param.start);
+					if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
+					status.moved_variables.add(param_value);
+				}
 			}
 		}
 		if (has_mov_keyword && !node.swap_params?.has(i) && param.node_type === "access" && param.access.node_type === "access_field") {
@@ -60381,6 +61175,8 @@ function check_function_call(node, status, func, target_type, self_value, self_p
 		if (swap_expr) {
 			if (!has_mov_keyword) add_error(status, `swap requires mv keyword`, swap_expr.start);
 			else {
+				const swap_param_error = borrowed_param_transfer_error(enclosing_function_param(status, param_value), status);
+				if (swap_param_error) add_error(status, swap_param_error, param.start);
 				check_node(swap_expr, status);
 				check_type_and_value_match(param_type, type_from_value_node(swap_expr, status), void 0, status, swap_expr.start, "swap");
 			}
@@ -61678,7 +62474,11 @@ function check_tuple_element_ownership(array, status) {
 		const t = type_from_value_node(value, status);
 		if (!t.name) continue;
 		if (is_owning_struct_type(t, status)) {
-			if (vn.is_moved || vn.literal_last_use_move) {
+			const transfer_error = borrowed_param_transfer_error(enclosing_function_param(status, vn.value), status);
+			if (transfer_error) {
+				add_error(status, transfer_error, value.start);
+				rejected = true;
+			} else if (vn.is_moved || vn.literal_last_use_move) {
 				vn.is_moved = true;
 				if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
 				status.moved_variables.add(vn.value);
@@ -61953,9 +62753,13 @@ function check_assignment_node(assign, status) {
 					return false;
 				}
 				if (src_sv && is_value_struct_conformer(src_sv.type.name, trait_name, status)) {
-					if (!assign.right_value.is_moved) assign.right_value.is_moved = true;
-					if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
-					status.moved_variables.add(src_name);
+					const boxing_param_error = borrowed_param_transfer_error(enclosing_function_param(status, src_name), status);
+					if (boxing_param_error) add_error(status, boxing_param_error, assign.right_value.start);
+					else {
+						if (!assign.right_value.is_moved) assign.right_value.is_moved = true;
+						if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
+						status.moved_variables.add(src_name);
+					}
 				}
 			} else if (assign.right_value.node_type !== "func_call") {
 				if (is_value_struct_conformer(type_from_value_node(assign.right_value, status).name, trait_name, status)) {
@@ -62033,12 +62837,16 @@ function check_assignment_node(assign, status) {
 		const raw = assign.right_value.value;
 		if (!(typeof raw === "string" && (raw.startsWith("\"") && raw.endsWith("\"") || raw === "null")) && rhs_type.name && is_owning_struct_type(rhs_type, status)) add_error(status, rhs_type.name === "string" ? `cannot copy a string by value — it owns its bytes; use 'mv' to transfer it, or .copy() for a deep copy` : `cannot copy '${rhs_type.name}' by value — it owns heap resources; use .copy() or mv`, assign.right_value.start);
 	}
-	if (assign.right_value.node_type === "value" && assign.right_value.is_moved && !assign.swap) {
-		if (status.values.findLast((v) => v.name === assign.right_value.value)?.is_ref_binding) add_error(status, `'${assign.right_value.value}' is a ref — mv the owner instead`, assign.right_value.start);
-		else {
-			enforce_root_not_frozen(assign.right_value.value, status, assign.right_value.start);
-			if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
-			status.moved_variables.add(assign.right_value.value);
+	if (assign.right_value.node_type === "value" && assign.right_value.is_moved) {
+		const transfer_error = borrowed_param_transfer_error(enclosing_function_param(status, assign.right_value.value), status);
+		if (transfer_error) add_error(status, transfer_error, assign.right_value.start);
+		else if (!assign.swap) {
+			if (status.values.findLast((v) => v.name === assign.right_value.value)?.is_ref_binding) add_error(status, `'${assign.right_value.value}' is a ref — mv the owner instead`, assign.right_value.start);
+			else {
+				enforce_root_not_frozen(assign.right_value.value, status, assign.right_value.start);
+				if (!status.moved_variables) status.moved_variables = /* @__PURE__ */ new Set();
+				status.moved_variables.add(assign.right_value.value);
+			}
 		}
 	}
 	if (assign.right_value.node_type === "value") {
@@ -63196,6 +64004,13 @@ function check_return_node(ret, status) {
 			if (param && !param.is_self_param && (param.is_ref || param.type.is_ref) && param_struct) add_error(status, `cannot return '${param.name}' — a 'ref' borrow escapes implicitly; declare the parameter 'mv' to transfer it`, ret.value.start);
 		}
 	}
+	if (func && ret.type.name && !func.return_type.is_view && !func.return_type.is_ref) {
+		const value_node = get_inner_value_node(ret.value);
+		if (value_node?.node_type === "value") {
+			const transfer_error = borrowed_param_transfer_error(func.params.find((p) => p.name === value_node.value), status);
+			if (transfer_error) add_error(status, transfer_error, ret.value.start);
+		}
+	}
 	if (func && borrow_depth_of(ret.value, status) !== void 0) {
 		const ret_value_name = value_from_value_node(ret.value);
 		const sv = ret_value_name !== void 0 ? status.values.findLast((v) => v.name === ret_value_name) : void 0;